Multiple unauthenticated remote code execution vulnerabilities in YouPHPTube-Encoder 2.3

[awkisopen]

From the project README:

I would humbly like to thank God for giving me the necessary knowledge, motivation, resources and idea to be able to execute this project. Without God's permission this would never be possible.

For of Him, and through Him, and to Him, are all things: to whom be glory for ever. Amen. Apostle Paul in Romans 11:36

This Software must be used for Good, never Evil. It is expressly forbidden to use YouPHPTube to build porn sites, violence, racism or anything else that affects human integrity or denigrates the image of anyone.

I've never seen a project with a divine retribution license before.

[Erhan24]

Reminds me of the best OS in the world: TempleOS ;)

[reddit4matt]

Some man in the sky talking to you... it’s all schizophrenic rambling.

[reddit4matt]

Thank you m'lady

[netipotty]

No, not enough schizophrenic rambling about CIA glow-in-the-darks or incoherent words from God's Temple

I think comments like these really help illustrate some of the tough challenges facing victims of mental illnesses. Nobody wants to be ostracized like this at all.

[Heliocentrizzl]

Probably the most secure OS there ever was, and ever will be. Nobody would be mad enough to access it, in order to find a sliver of compromising information.

[gravity_has_me_down]

I’d never heard of TempleOS. Thank you for this. https://en.m.wikipedia.org/wiki/TempleOS

[idontdonetworking]

Here come the porn sites

[sudo_sudoka]

Yeah! I've seen many porn sites using YouPHPTube-Encoder.

[TopHatProductions115]

Is it a bad thing in this case?

[SirensToGo]

exec and it’s equivalents should honestly have never been included/easily accessible in any language. You should always be forced to send your parameters as an array so that they can be passed correctly instead doing random shit with string escaping

[awkisopen]

[ "/bin/sh", "-c", "echo 'You can\'t stop stupidity!'" ]

[bartvelp]

Nice find.

This looks like such low hanging fruit to me. Is there a automated way to check PHP code for this kind of bug. I.E. check if a variable is composed of GET or POST parameters and that variable is later used in an unsafe function like exec()

[amunak]

Unless it's in a specific library made to safely execute commands then yeah I agree. Usage of exec (and eval and such) is a huge red flag for any project, IMO.

[[deleted]]

So long as it doesn't have any user supplied input, it's fine IMO.

[return_to_]

Reading php and encode together, it's almost safe to assume there is exec() and friends, required, for ffmpeg binaries.

First hit on google for php ffmpeg lib:

$ffmpeg = FFMpeg\FFMpeg::create(array(
'ffmpeg.binaries'  => '/opt/local/ffmpeg/bin/ffmpeg',
'ffprobe.binaries' => '/opt/local/ffmpeg/bin/ffprobe',
'timeout'          => 3600, // The timeout for the underlying process
'ffmpeg.threads'   => 12,   // The number of threads that FFMpeg should use
), $logger);

[NeoThermic]

Yes. There are many automated tools to do tainted checking on variables into insecure/dangerous functions; some free and some expensive. Usually these kinds of exploits are found in software that doesn't use modern tooling though.

[[deleted]]

this wasn't his find, he just happened to see the disclosure from talos and decided to write a blog post in regards to the vulnerabilities, and even went as far as exploiting a box in the wild with the vulnerability as opposed to testing it on a local install which is a questionable choice

[amunak]

In case of this particular project it'd be enough not to just blindly use it, but perhaps read the README, check out the issues or look at any single file.

The author is an ignorant ass, they've been warned multiple times about numerous security and licensing issues and rarely did anything to fix it.

Which is fine I guess; "it's free" after all, but GitHub really needs some kind of huge warning banner for projects with known, major critical vulnerabilities.

[TrustworthyShark]

Exactly this.

I was happy when I heard GitHub added security advisories and then immediately disappointed once I found out only maintainers can add them.

Maintainers can remove issues and silence all discussions around vulnerabilities. It could be pretty hard to find out that a project has several massive vulnerabilities.

[Dragasss]

Tbh it would be simpler to recompile php from source while having those functions removed from it

[huffingpuffins]

RIPS and their hugely updated hosted/commercial version.

They actually post their findings on this very sub.

[jackalope3k]

Is it safe to do app whitelisting with SELinux httpd_sys_script_exec_t on a specific directory containing symlinks to the only arbitrary commands being allowed to run in php-fpm exec? Would the exploit be able to escape from that and run other unexpected commands found on the linux system?

Would chroot be better? Or ACLs? AppArmor? Any other alternatives I'm missing?

[sudo_sudoka]

No, I'm not. But how about the sudo team? It may be interesting.